1. How the Sec and Cftc Divide Authority over Digital Assets
The most consequential threshold question in any Digital Assets and Web3 project is whether the asset or activity falls under SEC jurisdiction, CFTC jurisdiction, or neither, because the answer determines the entire compliance architecture the business must build around.
The current framework requires distinguishing the crypto asset itself from the transaction in which it is offered or sold. Under the joint interpretation issued by the SEC and CFTC in early 2026, many crypto assets may not themselves be securities, but a particular offer, sale, staking arrangement, or fundraising structure can still create an investment contract depending on the facts. This asset-versus-transaction distinction means that a token that functions as a digital commodity in secondary market trading may have been sold as a security in its initial fundraising round, and both characterizations can be accurate simultaneously for different transactions involving the same token. The SEC and CFTC's joint taxonomy identifies categories including digital commodities, digital collectibles, digital tools, payment stablecoins, and digital securities, and determining which category applies to a specific token requires a fact-specific analysis rather than a categorical rule.
The CFTC's jurisdiction in the digital assets space distinguishes between derivatives markets, where it has comprehensive regulatory authority over unregistered products, and spot commodity markets, where its primary tools are fraud and manipulation enforcement authority under the Commodity Exchange Act. Market-structure legislation pending in Congress, including the CLARITY Act introduced in 2025, would codify the jurisdictional division between the agencies and establish registration requirements for digital asset intermediaries, but that legislation had not been enacted as of mid-2026. The first legal question is not what the project calls the token, but what the asset does, how it is sold, who controls the network, and which users or jurisdictions the project reaches. Cryptocurrency regulation and digital asset compliance analysis must account for both current agency positions and the evolving legislative framework when advising on any token structure.
What the Howey Test Means for Tokens and How the Analysis Works in 2026
The Howey test asks whether a transaction involves an investment of money in a common enterprise with a reasonable expectation of profit derived predominantly from the efforts of others, and its application to digital asset issuances has produced a body of SEC guidance and enforcement outcomes that shapes every token launch, even as the asset-versus-transaction framework refines how the test is applied.
The investment of money element is satisfied by the payment of fiat or cryptocurrency for the token. The common enterprise element is typically satisfied when the token's value is tied to the overall success of the project and the pooled contributions of all buyers. The expectation of profit element is satisfied when the token is marketed in a way that emphasizes price appreciation potential rather than current utility value. The efforts of others element, which has become the most contested in digital asset cases, is satisfied when the issuer or a central promoter retains sufficient control over the network, the protocol development, or the token's value that buyers are relying on those parties' ongoing efforts to generate returns.
A token sold before its underlying network is functional, whose marketing emphasizes future development and potential returns, and whose value depends entirely on the founding team delivering on roadmap promises presents the clearest investment contract case in any single transaction. A token that is fully functional at the time of sale, is used primarily for its stated utility purpose, and whose value is driven by market supply and demand rather than by any central promoter's ongoing development presents the strongest case against investment contract classification. The 2026 SEC-CFTC joint interpretation underscores that the same token can be involved in investment contract transactions at one stage and non-investment-contract transactions at another, which requires ongoing legal monitoring throughout a project's lifecycle. Before launch, the team should map each activity against securities, commodities, money transmission, sanctions, tax, and state licensing rules, because the relevant classification for each activity may differ from the classification for the token itself. Token issuance and cryptocurrency and digital asset law counsel must structure token offerings with these factors in mind from the earliest design stage.
2. What Nfts, Daos, and Defi Create Legally in Digital Assets & Web3
Non-fungible tokens, decentralized autonomous organizations, and decentralized finance protocols are the three areas where Digital Assets & Web3 legal exposure is most concentrated outside the token offering context, and each raises distinct legal questions that the cryptocurrency regulatory framework does not fully address.
NFTs occupy an uncertain legal position that depends on what the specific NFT represents, how it was marketed, and what rights it confers. An NFT sold primarily as a collectible with no profit expectation and no issuer ongoing obligation presents the weakest securities analysis. An NFT sold in a series with royalty mechanics, profit-sharing arrangements, or promotional materials emphasizing price appreciation presents a substantially stronger argument for investment contract treatment under the transaction-level analysis that the current SEC-CFTC framework applies. The intellectual property analysis is equally important: an NFT buyer typically acquires ownership of the token on the blockchain but not a copyright in the underlying work, not a trademark license, and not any commercial use rights unless those rights are expressly granted in the terms governing the specific project. DeFi protocols that automatically execute financial transactions including lending, borrowing, liquidity provision, and derivatives trading raise questions about whether the protocol operators are providing regulated financial services, whether the protocol's governance token involves an investment contract transaction, and whether the protocol's smart contracts create legal obligations between users.
The distinction between a protocol that is genuinely decentralized and one that is nominally decentralized but effectively controlled by a founding team through admin keys or governance token concentration is one of the most significant legal facts in any Web3 regulatory analysis. A protocol whose founding team retains the ability to pause the protocol, upgrade contracts, or redirect funds has a meaningful control fact that regulators evaluate when determining who is legally responsible for the protocol's operation. Blockchain and fintech regulation analysis for DeFi protocols requires mapping the governance structure, admin key controls, and founding team's ongoing role against current agency standards before any public launch.
How Dao Legal Structure Works and What Unincorporated Daos Expose Participants to
A decentralized autonomous organization that has not adopted a legal entity structure may be treated as an unincorporated association or general partnership under applicable state law, and active governance participants may face liability theories that token holders who take no governance role do not.
The legal exposure of an unincorporated DAO was demonstrated in the CFTC's enforcement action against the Ooki DAO, in which the CFTC obtained a default judgment against the DAO as an unincorporated association and argued that token holders who participated in governance voting were members of that entity with potential personal liability for its regulatory violations. An unincorporated DAO may expose active governance participants to association or partnership-style liability theories, but liability is not automatic for every token holder. The analysis depends on governing law, the extent of voting participation, the degree of control exercised, whether an entity wrapper exists, and the specific claim asserted. Subsequent DAO-related litigation has shown that courts and regulators continue to develop these theories, with varying approaches across jurisdictions. Legal entity options including a Wyoming DAO LLC, a Cayman foundation, or a Marshall Islands DAO structure each provide member liability protection while presenting different tradeoffs in regulatory visibility, tax treatment, and governance flexibility.
A DAO that adopts a legal entity structure addresses the member liability question but does not eliminate regulatory compliance obligations arising from the DAO's activities. Entity formation and regulatory compliance are separate analyses that both require attention before the DAO operates any financial services or distributes any tokens to the public. DAO governance and blockchain dispute practice must address the entity structure question and the underlying regulatory activity question as independent steps, because a well-structured entity running an unregistered derivatives exchange remains subject to enforcement regardless of its governance documents.
The NFT market has produced intellectual property disputes that the general digital assets regulatory framework does not address. An artist whose work was minted as an NFT without authorization has copyright infringement claims against the minter regardless of what the blockchain records show, because NFT ownership on a blockchain does not create copyright or supersede the rights of the original creator. An NFT project that uses third-party brand names, logos, or characters without a license creates trademark infringement exposure for the project founders and potentially for the platform that listed the NFTs for sale. An NFT buyer who discovers that the project's stated utility was not delivered may have claims for fraud, breach of contract, or state consumer protection violations against the project founders. UCC Article 12 provides commercial-law rules for controllable electronic records in adopting states, including transfer and control concepts, but it does not by itself resolve securities status, tax treatment, intellectual property rights, or every ownership dispute. NFTs and NFT patent practice in Web3 requires addressing IP ownership, licensing, and buyer rights documentation at the project design stage, because post-launch disputes in this space are difficult to resolve when founding teams are pseudonymous and project terms were never clearly articulated.
3. What Web3 Businesses and Token Projects Must Address before Launch
A Web3 business that launches a token, operates an exchange, provides custody services, or deploys a protocol that routes user funds has made decisions before its first user transaction that determine its entire regulatory exposure, and those decisions are substantially harder to unwind after launch than before.
Digital asset exchanges, custodians, and certain wallet providers that engage in money transmission as a business must register with FinCEN as money services businesses and comply with Bank Secrecy Act obligations including anti-money-laundering program requirements, customer identification procedures, Suspicious Activity Report filing, and OFAC sanctions screening. State money transmission licensing is a separate requirement that applies in most states regardless of federal MSB registration, and New York's BitLicense imposes particularly comprehensive requirements including capital, cybersecurity, and consumer protection standards. OFAC sanctions compliance requires Web3 businesses to screen wallet addresses against the SDN List and other sanctions lists, understanding that the agency's enforcement reach extends to decentralized protocols as well as centralized intermediaries. The Tornado Cash enforcement and litigation episode illustrated both the reach of sanctions authority over smart contract addresses and its limits, as the designations were ultimately removed from the SDN List in March 2025 following litigation; the episode remains a significant precedent for how OFAC approaches decentralized protocols, and the analytical framework it established continues to shape compliance obligations for protocol operators.
Payment stablecoin issuers now operate under the GENIUS Act, enacted in July 2025, which establishes a federal regulatory framework requiring permitted payment stablecoin issuers to satisfy reserve, redemption, disclosure, custody, AML, and supervisory requirements before issuing covered instruments to the public. Stablecoin analysis should begin with whether the issuer qualifies as a permitted payment stablecoin issuer under the Act, what compliance obligations apply at the federal versus state level, and when the Act's implementing regulations make specific requirements effective. Stablecoin regulation and virtual currency license requirements under the GENIUS Act represent the most significant near-term compliance obligation for any entity issuing or distributing dollar-denominated digital instruments.
How Aml, Ofac, and Tax Obligations Apply Across Digital Assets
AML, sanctions, and tax compliance in Digital Assets and Web3 apply to businesses and in some contexts to individual participants, and the obligations are not limited to entities that explicitly identify as financial institutions.
OFAC sanctions apply to U.S. .ersons and entities transacting with sanctioned individuals, entities, or jurisdictions regardless of the payment instrument used, and OFAC has published guidance specifically addressing cryptocurrency transactions. The Tornado Cash episode demonstrated that OFAC is willing to designate smart contract addresses and that U.S. .ersons interacting with designated infrastructure face sanctions exposure, while also showing that legal challenges to such designations can succeed and that the agency's authority over immutable smart contracts raises distinct legal questions from its authority over human counterparties. Platforms that fail to screen wallet addresses against OFAC's current SDN List face civil penalties, and the blockchain analytics infrastructure that OFAC, the IRS, and other agencies use to trace digital asset transactions makes compliance failures more detectable than protocol-level privacy features can reliably prevent.
Tax treatment of digital assets follows IRS Notice 2014-21 and Revenue Ruling 2019-24, which treat cryptocurrency as property, making every disposal a potentially taxable event. For Web3 businesses that pay contributors, service providers, or validators in digital assets, the payment creates ordinary income for the recipient at the fair market value of the asset at the time of receipt, and the business may have withholding and reporting obligations depending on the recipient's status. Starting with 2025 transactions, many U.S. .igital asset brokers are required to report gross proceeds on Form 1099-DA, with basis reporting requirements expanding in 2026. Cryptocurrency taxation and crypto business compliance requires maintaining accurate records of every digital asset transaction, every payment to contributors, and every treasury operation from the first day of operations.
4. Frequently Asked Questions about Digital Assets and Web3 Law
Digital assets and Web3 legal questions arrive from founders designing token structures and wanting to understand whether their token is a security before they launch, from investors in digital asset projects who want to understand their rights when a project fails to deliver, from protocol developers evaluating DAO structure options and the liability implications of each, and from businesses that accepted cryptocurrency as payment and want to understand their compliance obligations.
What Are Digital Assets and Web3 from a Legal Perspective?
Digital assets is the term U.S. .egulators including the SEC, CFTC, and IRS use to describe cryptocurrencies, tokens, NFTs, stablecoins, and other value-bearing instruments that exist on distributed ledger technology. Web3 refers to internet infrastructure built on blockchain networks, characterized by decentralized protocols, user-controlled data, and token-based economic coordination. From a legal perspective, digital assets and Web3 do not constitute a single regulatory category: a specific digital asset may be a security, a commodity, a money transmission instrument, a taxable property, or a payment stablecoin subject to the GENIUS Act, depending on its structure, how it was offered, and what activity is involved. The legal analysis is asset-specific, transaction-specific, and fact-specific rather than categorical.
Does a Crypto Asset Itself Have to Be a Security for Securities Law to Apply?
Not necessarily. Under the SEC and CFTC's joint interpretation issued in 2026, the relevant question is whether a particular transaction involving the asset, rather than the asset itself, constitutes an investment contract. A token that functions as a digital commodity in secondary market trading may have been sold as a security in its initial fundraising round, and securities law applies to that fundraising transaction even if the token itself is not a security in other contexts. The offer, sale, staking arrangement, or fundraising structure is what creates the investment contract, and the analysis evaluates the specific transaction's facts rather than classifying the asset categorically. This distinction means a project's legal status must be assessed at each stage, including launch, secondary market development, protocol maturation, and any new fundraising or staking program introduced after launch.
What Changed after the Genius Act for Stablecoin Issuers?
The GENIUS Act, enacted in July 2025, established a federal regulatory framework for payment stablecoins that requires issuers to qualify as permitted payment stablecoin issuers and to satisfy reserve, redemption, disclosure, custody, AML, and supervisory requirements. Before the GENIUS Act, stablecoin issuers operated in a fragmented regulatory environment where state money transmission laws, potential SEC securities classification, and CFTC commodity analysis each applied in different circumstances with no unified federal framework. After enactment, the first compliance question for any entity issuing or distributing dollar-denominated digital instruments is whether the instrument qualifies as a payment stablecoin under the Act, what the applicable issuer requirements are at the federal versus state level, and when the Act's implementing regulations make specific obligations effective. The GENIUS Act does not address non-payment stablecoins, algorithmic stablecoins, or digital assets that are not designed to maintain a stable value, which remain subject to the pre-existing regulatory analysis.
How Do I Know If My Token Is a Security under Current Law?
The primary framework is the Howey test: whether the token transaction involves an investment of money in a common enterprise with a reasonable expectation of profit derived predominantly from the efforts of others. Under the current SEC-CFTC joint interpretation, the analysis focuses on the specific transaction rather than the asset itself, so a token can be involved in an investment contract transaction during fundraising but not in secondary trading once the network is functional and decentralized. A token sold before its network is functional, marketed with emphasis on future development and potential returns, and whose value depends on the founding team's ongoing efforts presents the strongest investment contract case. A token that is fully functional at sale, used primarily for utility, and not promoted as an investment presents the weakest case. Any public distribution of tokens to U.S. .ersons requires a securities law analysis before launch, because the cost of retroactive compliance or enforcement defense substantially exceeds the cost of pre-launch structuring.
What Liability Do Dao Participants Have If the Dao Is Sued?
An unincorporated DAO may be treated as an unincorporated association or general partnership, and active governance participants may face liability theories that passive token holders who take no governance role do not. Liability is not automatic for every token holder; the analysis depends on governing law, the extent of voting participation, the degree of control exercised, whether an entity wrapper exists, and the specific claim asserted. The CFTC's enforcement action against the Ooki DAO established that federal regulators are willing to pursue DAO governance participants as members of an unincorporated entity for regulatory violations, and subsequent litigation has shown that courts and regulators continue to develop these theories with varying approaches across jurisdictions. Adopting a legal entity structure such as a Wyoming DAO LLC or a Cayman foundation addresses the member liability question but does not eliminate the compliance obligations arising from the DAO's underlying activities.
What Compliance Does a Web3 Business Need before It Starts Operating?
The answer depends on what the business does, but every Web3 business should address securities, commodities, money transmission, sanctions, tax, and state licensing before the first user transaction. A business that exchanges, transfers, or provides custody of digital assets for others must register with FinCEN as a money services business and comply with BSA AML obligations. Operating in New York without a BitLicense or applicable exemption creates enforcement exposure. A business that issues tokens to the public must evaluate securities registration or exemption requirements. An entity issuing a payment stablecoin must evaluate GENIUS Act compliance. All businesses must screen against OFAC sanctions lists and maintain IRS-compliant transaction records. The compliance architecture for each activity should be designed before launch, not assembled in response to regulatory contact.
24 Jun, 2025
